A 6-lens hostile panel with adversarial verification confirmed 17 attacks that
would hold in a public takedown. All repaired: the MI contract now carries the
two base-fee floor-lapse windows (12,978,617-13,087,959 and
13,596,033-13,596,141) as explicit ruleset validation exceptions, so a stranger
implementing the written rules no longer halts where our own follower did; the
honesty boundary now states the full record of reject-on-disagreement including
the windows, and why the fact stays load-bearing; the independence claim is
bounded (upstream skeletons yes, AERE ruleset has one author in both forks, so
a common-author bug passes any differential gate by construction); the harness
verdict claims only what it measures, records engine identity via
web3_clientVersion on every run, refuses same-URL endpoint pairs, and prints
its NOT MEASURED block on every run; stage 4 names the live engine (upstream
parallel processing enabled by default, idling on empty blocks) and its
oracle's model limits; 'governed registry' became 'owner-controlled' with the
single-key fact stated. The panel also confirmed the import-proof doc claimed
a two-month validation history where six days is the truth; fixed.
The governed on-chain registry (AereCryptoRegistry) maps every registered
post-quantum algorithm to a live verifier: measured 2026-08-15, all 5
algorithms (Falcon-512, Falcon-1024, ML-DSA-44, SLH-DSA-128s, SHAKE256)
resolve to the live NIST precompiles 0x0AE1..0x0AE5, status active, and the
registry contract itself bears code. So 'crypto agility' is not a slide: adding
a scheme or retiring one is a governed registry write, not a hard fork.
Negative control: a planted fake verifier address is caught. Read-only,
eth_call and eth_getCode only. Building this caught two of my own decode bugs
(wrong selector, wrong tuple word) before they became a false public claim,
which is what verification-before-publication is for.
